Fix: riscv_debug stack buffer overflow in 128-bit CSR access #2240

mTOTm commented 2026年04月26日 13:01:07 +02:00

Detailed description

The purpose of this PR is to fix the crash of BMDA under specific conditions. The failure condition is: "Set 'CFLAG' to '-fstack-protector-strong', when debugging a RISC-V target with 4 data registers." This was first discovered when debugging the HPM chip in Ubuntu 22.04. Thank you @ALTracer for helping to locate the issue. It was resolved by increasing the size of the local array in the register, and the test with STLINK-V2-BMP was successful.

Test Log

./build_stlink/blackmagic -tj
Black Magic Debug App v2.0.0-531-gff4d9e2f-dirty
 for Black Magic Probe, ST-Link v2 and v3, CMSIS-DAP, J-Link, FTDI (MPSSE) and WCH-Link
Using 1d50:6018 DFD496DE Black Magic Debug
 Black Magic Probe (ST-Link/v2) v2.0.0-503-gd8d74921-dirty
Running in Test Mode
Target voltage: 3.30V
Speed set to 6.000MHz for JTAG
Resetting TAP
Change state to Shift-DR
Scanning out ID codes
Return to Run-Test/Idle
Change state to Shift-IR
Scanning out IRs
Return to Run-Test/Idle
Change state to Shift-DR
Return to Run-Test/Idle
ID code 0x1000563d: Andes Tech RISC-V DTM.
RISC-V debug v0.13/v1.0 DMI
RISC-V debug v0.13 DM
Hart has 4 data registers and 8 progbuf registers
Attempting 128-bit read on misa
CSR access failed: 2
CSR access failed: 2
CSR access failed: 2
CSR access failed: 2
Attempting 64-bit read on misa
CSR access failed: 3
CSR access failed: 3
CSR access failed: 3
Attempting 32-bit read on misa
Hart 0: 32-bit RISC-V (arch = 80000025), rv32igcb ISA (exts = 0090112f), vendor = 61e, impl = 410
Hart has 8 trigger slots available
-> riscv32_probe
Please report unknown device with Designer 0x61e
Probing failed, please report unknown RISC-V 32 device
*** 1 RISC-V rv32igcb

Your checklist for this pull request

• I've read the Code of Conduct
• I've read the guidelines for contributing to this repository
• It builds for hardware native (see Building the firmware)
• It builds as BMDA (see Building the BMDA)
• I've tested it to the best of my ability
• My commit messages provide a useful short description of what the commits do

Closing issues

Fixes #2239.

<!-- Filling this template is mandatory --> ## Detailed description The purpose of this PR is to fix the crash of BMDA under specific conditions. The failure condition is: "Set 'CFLAG' to '-fstack-protector-strong', when debugging a RISC-V target with 4 data registers." This was first discovered when debugging the HPM chip in Ubuntu 22.04. Thank you @ALTracer for helping to locate the issue. It was resolved by increasing the size of the local array in the register, and the test with STLINK-V2-BMP was successful. ### Test Log ```bash ./build_stlink/blackmagic -tj Black Magic Debug App v2.0.0-531-gff4d9e2f-dirty for Black Magic Probe, ST-Link v2 and v3, CMSIS-DAP, J-Link, FTDI (MPSSE) and WCH-Link Using 1d50:6018 DFD496DE Black Magic Debug Black Magic Probe (ST-Link/v2) v2.0.0-503-gd8d74921-dirty Running in Test Mode Target voltage: 3.30V Speed set to 6.000MHz for JTAG Resetting TAP Change state to Shift-DR Scanning out ID codes Return to Run-Test/Idle Change state to Shift-IR Scanning out IRs Return to Run-Test/Idle Change state to Shift-DR Return to Run-Test/Idle ID code 0x1000563d: Andes Tech RISC-V DTM. RISC-V debug v0.13/v1.0 DMI RISC-V debug v0.13 DM Hart has 4 data registers and 8 progbuf registers Attempting 128-bit read on misa CSR access failed: 2 CSR access failed: 2 CSR access failed: 2 CSR access failed: 2 Attempting 64-bit read on misa CSR access failed: 3 CSR access failed: 3 CSR access failed: 3 Attempting 32-bit read on misa Hart 0: 32-bit RISC-V (arch = 80000025), rv32igcb ISA (exts = 0090112f), vendor = 61e, impl = 410 Hart has 8 trigger slots available -> riscv32_probe Please report unknown device with Designer 0x61e Probing failed, please report unknown RISC-V 32 device *** 1 RISC-V rv32igcb ``` <!-- Explain the **details** for making this change. * Is a new feature implemented? * What existing problem(s) does the pull request solve? * How does the pull request solve these problems? Please provide enough information so that others can review your pull request. Information embedded in the description part of the commits doesn't count. --> ## Your checklist for this pull request * [x] I've read the [Code of Conduct](https://codeberg.org/blackmagic-debug/blackmagic/src/CODE_OF_CONDUCT.md) * [x] I've read the [guidelines for contributing](https://codeberg.org/blackmagic-debug/blackmagic/src/CONTRIBUTING.md) to this repository * [x] It builds for hardware native (see [Building the firmware](https://codeberg.org/blackmagic-debug/blackmagic?tab=readme-ov-file#building-the-firmware)) * [x] It builds as BMDA (see [Building the BMDA](https://codeberg.org/blackmagic-debug/blackmagic?tab=readme-ov-file#building-black-magic-debug-app)) * [x] I've tested it to the best of my ability * [x] My commit messages provide a useful short description of what the commits do ## Closing issues Fixes #2239. <!-- put "fixes #XXXX" here to auto-close the issue(s) that your PR fixes (if any). -->

mTOTm commented 2026年05月05日 08:06:24 +02:00

@dragonmux wrote in #2240 (comment):

LGTM, merging once CI completes. Thank you for the contribution!

I have rebased this PR onto main.

@dragonmux wrote in https://codeberg.org/blackmagic-debug/blackmagic/pulls/2240#issuecomment-14221922: > LGTM, merging once CI completes. Thank you for the contribution! I have rebased this PR onto main.